In episode 8 we’ll cover how to identify and troubleshoot memory leaks in the kernel virtual address space. I’ll demo a system crash/lockup and then show what it looks like in perfmon, then expand on how to identify the offending pooltag in the kernel using poolmon.exe. We specifically focus on the nonpaged pool, the paged pool, and system PTE’s as well as the pertinent counters that correlate with thresholds of each “bucket”.